- Analyzer
- semgrep
- Category
- Secrets
- Default severity
- HIGH
- CWE
- CWE-327
- Execution
- Passive
- Authentication
- Not required
- Applicability
- python
- Availability
- stable
What it detects
Legacy symmetric cipher imported (DES, 3DES, RC4, ARC2, Blowfish): a secrets check run by the semgrep analyzer.
Evidence
The Semgrep source location, rule identity, and bounded match context normalized into Fendix evidence.
Remediation
Legacy / broken symmetric cipher imported (DES, 3DES, RC4, ARC2, Blowfish). These are no longer considered secure. Use AES-GCM, AES-CCM, or ChaCha20-Poly1305 instead.
Limitations
This check is limited to the applicability and evidence delivered by semgrep. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence
Checks sharing a CWE
Remediation guidance: Remediation and fix verification · Baselines and suppressions
Other secrets checks